Define and verify the public Rust alpha API

[ITSMERNB]

Summary

Closes #3.

• classify the intentional public alpha API and explicit experimental surfaces
• document SemVer intent and a staged crates.io publication order
• add a separate external consumer crate covering provider, tool, routing, contract, proof, and message APIs
• treat public Rustdoc warnings as errors
• fully package-verify the first publication candidates (sc-message-types, sc-contract, sc-proof)
• validate later-wave provider/tool package manifests without publishing anything
• run the public API gate on both Windows and Linux CI

Local verification

• external consumer: 3/3 pass
• Rustdoc -D warnings: pass
• Wave 1 cargo package verification: pass for all three crates
• fmt/check/clippy: pass
• workspace tests: 272 passed, 0 failed, 1 privilege-dependent Windows symlink test ignored
• release build: pass
• public beta gate: 16 pass, 0 fail, 1 honest skip
• separate tracked-file secret scan: 115 files, 0 hits

No crates.io publication is performed by this PR.